Trojan.StartPage.59301

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'wtgkgyfavptizhvo' WindowName: 'kwleisoxudboqayit'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsf2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll
%TEMP%\nsf2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'maaznbcbatiiujodwsjnh' WindowName: 'ujwmfxozdemnayzfdtunvfojgekldpnj'
ClassName: 'qmucgrkizsymtxyttubvttpphwcnuzkr' WindowName: 'fjqkvxgmxnfqbhjgnwhqaxkaoeeayhlq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ohwiqhzqeanrxxmodjdzuldx' WindowName: 'prsflbfemvtesakezgmsxgozdkjnkbefjhsa'
ClassName: 'hncjmwjkxtdwszvnwyfkjewdkvamhuowmt' WindowName: 'tujdosfqvcjmkccbeyywqmlkeoqxvvx'
ClassName: 'dyljyyiypjwjmfrrubtohdheaak' WindowName: 'ahszgjqnbpdyaaaqhglmlejalelnk'
ClassName: 'mkjsfjvmhnsmlhtmaxtftcdlli' WindowName: 'wgzfwxdvdfiwhktnylwtgmhmjk'
ClassName: 'eurarejyuwhdyaytghhrnoviwlkblwjjyxsgoxh' WindowName: 'xsvelhmxmqnbjaccycuceqiokyurq'
ClassName: 'ylywlkgjtvrxyqw' WindowName: 'fbikqqqgtszindefgetu'
ClassName: 'smdfntxfkjeepqooacrirtpwlkabspnr' WindowName: 'pexylbgtmpzqhxrbffqmymkgvjkptoituviz'
ClassName: 'hjzeuanvnnkczmoyvzabyt' WindowName: 'iynjwnbjmyyemjxzplozaeuuk'
ClassName: 'zdushhpjcsgnrhrnqwzcoyho' WindowName: 'dfzyhapsrqcccwquraiqslxjqpqlfkzgnxd'
ClassName: 'odqljnzzrqucnwfudgpf' WindowName: 'gxbkshitvxyagsk'
ClassName: 'elopztlpbiuggyerexbvsyrikullhgtfaqsknzh' WindowName: 'xhgjxsrdaqdobunhkxnqtzurdlbgweag'
ClassName: 'rifmbjfbndcxoyjkyybaapy' WindowName: 'qrgfjgdamincqlp'
ClassName: 'bggmcnfdlxxtqse' WindowName: 'bkmxldftxdyjpoisepbknborcyyvhwovnjdsabl'
ClassName: 'gwbwrzybmkyonhmpgpwxojnyqgjnrndtm' WindowName: 'ecxzgmqpvcmfaclisycnkuhpetqebsxceubkozm'
ClassName: 'hyzhzrdenfbyxoanajdksgl' WindowName: 'acfmxgxexeunteqreeikrxpcqtpahd'
ClassName: 'wzaifjuowwvkkqapralfefdvoclq' WindowName: 'gcfzzeuomktinwgrc'
ClassName: 'jsrscndpdgnlqrgnceuqgjozcy' WindowName: 'ibiuspeknkuavlvazyrgwbxxx'
ClassName: 'hjvtwvvmjgxsyguxxqmpbuhwjaci' WindowName: 'ftlglyknazgvicefqnymjfqfrhzosygitd'
ClassName: 'rhkcnjvowrngszubhqyznycisimojwat' WindowName: 'eiudxzowmdurxvtpudhclsbkcsamogngooxf'
ClassName: 'cahumrbcxspxrwiynfhcpqhze' WindowName: 'pwahnekdchpxwtmqsyd'
ClassName: 'uwfjhlbrolnogpbwypyqysoqkbrfzo' WindowName: 'xomikzlodskmzpvzruuajtcwznxmr'
ClassName: 'zgsxrrtfovaknqztc' WindowName: 'yppaqgfzecmeolaoxalqprsihqhrykxjgpjp'
ClassName: 'xhqjipyflzzuijuimia' WindowName: 'rzumyyatyxxabdlpf'
ClassName: 'owyxzisaltxhgldxt' WindowName: 'vunyesilzkxxjwxzfuyp'
ClassName: 'dzacqnefqhkqhkjwmd' WindowName: 'gmshyalyfltdnag'
ClassName: 'ksmyzyqjydcbtkqioyrzpnvcj' WindowName: 'itevoaghuvtfjmngyicxkwcwctynuwka'
ClassName: 'eiqkkpuimdgogmxpdzouwulp' WindowName: 'paqwapbecalaryese'
ClassName: 'wqbzoqojytgoxbdbd' WindowName: 'xkpfdjdmtipthmgwcgwmyjrlwdorxnxrosukpl'
ClassName: 'ffwgxqtkatravujdmg' WindowName: 'raqrrxnxknmxzow'
ClassName: 'jmasogiawubahgdinpqv' WindowName: 'ugmmbwmviscflzpgfddufwixvnxlsnei'
ClassName: 'aqkdycoodywaqcnqbdvwwlhgbgbhwiuhf' WindowName: 'zhzrqwrzvonrexhajezrzgw'
ClassName: 'kxitarvoyfeqqipixa' WindowName: 'vxtlbipbdcxcfqy'
ClassName: 'oocdktebzbofbszf' WindowName: 'mhhwfdvxxqroujxnbvczbpozdtvebkobexhxc'
ClassName: 'donbbgjluetmihnoerqbh' WindowName: 'oaawrzdcwcgetnsxrolweiwgzfxlxbvtleho'
ClassName: 'pxezgjhngtfqsxkwnotnvzfwgbpohieodbvar' WindowName: 'jzgligtfsntsfhbzpnsmfnjlyetybxgajpcujfu'
ClassName: 'oqsrlzofwkfojehkkyrnpljfmdnsslvrrkbous' WindowName: 'huyofeuixmewzogowtwjbnu'
ClassName: 'fokqhdeceikfmfenvintldvslu' WindowName: 'sryquohchbvsnbpbrygswonkbx'
ClassName: 'xffxjnqnerurvtqxcttazp' WindowName: 'edkkqmojcuexngkj'
ClassName: 'irwptnnleqwlqqpuobmbjahrnqspfomslunns' WindowName: 'qskvurgbosruukhvnxeakfcfjlwslnerp'
ClassName: 'smjzsyddkmepcuxgzvht' WindowName: 'pfjdmelpnpbetluqxfjqc'
ClassName: 'jxnfoqbubtedyvnudwlgfmncb' WindowName: 'pcfcymopoupckrpvsixdjz'
ClassName: 'cbaffuwcamvxmavgjzmffweobsyixnz' WindowName: 'aeuwcrfunnrdtegclrkfvluwhswig'
ClassName: 'mjeentuvdagxmiexocbgrskhsqcshmidsg' WindowName: 'xzogojavtfyllnzide'
ClassName: 'xqsyhgmakivwmurtcyafzlylwqnnnvwqciinys' WindowName: 'hvzrtykuhscdzcgpgjreipmllopojphypm'
ClassName: 'funtbdkfpofrmkedajcmchzscuhgki' WindowName: 'qkvuixkdfpqjboxerhgjhegpsxnhdtzgvgyxqcp'
ClassName: 'ehoxsrukjphqrvmyjobzedjep' WindowName: 'emishcuelbwiippwvqkpxemtenfeylmva'
ClassName: 'ykiyhyhfiwwykdcrhtystjr' WindowName: 'tcmqnnfhauvyvckiyf'
ClassName: 'knmvmtzgbpzmddfjeoqfw' WindowName: 'fyaqfujxpienhegrtrzxmjgyhihane'